CVE-2020-35243

Flamingo (aka FlamingoIM) through 2020-09-29 contains a SQL injection vulnerability in UserManager::updateUserInfoInDb. The CVE is supported by multiple sources (NVD entry and Red Hat PR) showing high/severe impact: CVSSv2 base 7.5 (Partial confidentiality/integrity/availability impact) and CVSSv...

CVE-2020-35243

Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb...

CVE-2020-35242

Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory...

CVE-2020-35242

Flamingo (aka FlamingoIM) prior to 2020-09-29 contains a SQL injection in UserManager::updateUserTeamInfoInDbAndMemory. The CVE entry lists impacted product as Flamingo/FlamingoIM with a vulnerability that enables database/memory info manipulation via user-team info updates. From the initial data...

CVE-2020-35284

Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...

Directory traversal

Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...

CVE-2020-35284

Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...

CVE-2020-35284

Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...

CVE-2020-35284

CVE-2020-35284 affects Flamingo (aka FlamingoIM). The vulnerability allows directory traversal (via ../) in file-transfer requests; the issue arises because the only ostensibly unpredictable part is an MD5 computation that runs on the client side, and the computation details can be inferred from ...

CVE-2020-35284: Improper Limitation of a Pathname to a Restricted Directory

Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...

CVE-2020-35244: Improper Neutralization of Special Elements used in an SQL Command

Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup...

Blizmax Flamingoim SQL Injection Vulnerability

Blizmax Flamingoim is a high-performance, lightweight, open source instant messaging software from the individual developers of Blizmax. A SQL injection vulnerability exists in Blizmax Flamingoim version 2020-09-29 and prior versions, which stems from the validation of externally entered SQL...

Blizmax Flamingoim SQL Injection Vulnerability

Blizmax Flamingoim is a high-performance, lightweight, open source instant messaging software from the individual developers of Blizmax. A SQL injection vulnerability exists in Blizmax Flamingoim version 2020-09-29 and earlier versions, which stems from UserManager::addUser...

PT-2020-17309

Name of the Vulnerable Software and Affected Versions Flamingo aka FlamingoIM through 2020-09-29 Description The issue allows for ../ directory traversal. This is possible because the only unpredictable part of a file-transfer request, an MD5 computation, occurs on the client side. Since the...

Blizmax Flamingoim Path Traversal Vulnerability

Blizmax Flamingoim is a high-performance, lightweight, open source instant messaging software from the individual developers at Blizmax. A path traversal vulnerability exists in Blizmax Flamingoim version 2020-09-29 and earlier, which stems from the fact that the only ostensibly unpredictable par...

CVE-2020-35243: Improper Neutralization of Special Elements used in an SQL Command

Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb...